SSL certificates download

Question

I am attempting to use requests package from python to access this site: https://egov.uscis.gov/casestatus/landing.do When I ran this command:

requests.get('https://egov.uscis.gov/casestatus/landing.do')

I got the usual SSL error when your authentication verification fails..

Read through stackoverflow and adopted one of the solutions: download the certificate in (.crt) and then used openssl to convert to .pem file. I then copied the contents from this .pem file to the end of cacert.pem. However this did not work.

>>> requests.get('https://egov.uscis.gov/casestatus/landing.do')
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "C:\Users\Sandra\Anaconda\lib\site-packages\requests\api.py", line 69, in get
    return request('get', url, params=params, **kwargs)
  File "C:\Users\Sandra\Anaconda\lib\site-packages\requests\api.py", line 50, in request
    response = session.request(method=method, url=url, **kwargs)
  File "C:\Users\Sandra\Anaconda\lib\site-packages\requests\sessions.py", line 465, in request
    resp = self.send(prep, **send_kwargs)
  File "C:\Users\Sandra\Anaconda\lib\site-packages\requests\sessions.py", line 573, in send
    r = adapter.send(request, **kwargs)
  File "C:\Users\Sandra\Anaconda\lib\site-packages\requests\adapters.py", line 431, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)

Any pointers as to how I can overcome this without resorting to verify=False

Also Is there any difference in downloading the file via https://superuser.com/a/97203 and https://superuser.com/a/176721?

Because I have no issue with requests.get('https://www.google.com'), do other websites place restrictions on the certificate you download?

Answer 1

egov.usics.gov does not provide a complete chain in its SSL handshake.

You'll need to employ a workaround similar to what's suggested here until the site administrator fixes the certificate chain issue. The intermediate certificate in your case can be obtained from https://ssl-tools.net/certificates/yuox7i-symantec-class-3-secure-server-ca

Answer 2

There are three ways to setup CA cert:

• $ pip install certifi then
  >>> requests.get(url, verify=certifi.where())

• >>> requests.get(url, verify='/path/to/cert_bundle_file')

• >>> os.environ['REQUESTS_CA_BUNDLE'] = '/path/to/cert_bundle_file'
>>> requests.get(url)